Snapshot
- Injunctions against ‘persons unknown’ have become a mainstay of cyber incident response in Australia, following a pioneering application granted in 2024.
- The technique draws on a line of UK precedents, tracing back to a 2003 injunction granted to suppress the leak of an unpublished Harry Potter novel.
- This article unpacks the history and development of injunctions against persons unknown and gives an inside look at the strategic and technical complexities involved from the team behind the leading Australian case.
It all started with a coffee catch-up in 2021 with an old law school friend, Tamir Maltz, now counsel at the New South Wales bar. On the agenda for discussion was how litigation might be deployed as a tool in the event of a cyber incident, not a common approach in Australia at that time. We discussed developments and cases in foreign jurisdictions and canvassed different types of tools, including injunctions to recover bitcoin ransom payments or restrain publication of stolen data, and why those tools might be worth utilising.
We continued the discussion over subsequent months, occasionally swapping notes on the latest overseas cases of interest. As part of our team’s day-to-day work in the HWL Ebsworth (‘HWLE’) cyber incident response practice, we started floating the idea with clients who had been hacked, gauging any interest in pursuing such an approach. However, such a course of action would be risky, expensive and unprecedented in Australia. Understandably, the appetite was not high.
Little did we know that the opportunity to test these ideas would come when HWLE became the subject of its own cyber incident in 2023. That original coffee meeting and discussion two years prior suddenly took on a new significance. On the June long weekend, we called Mr Maltz following partial publication of data on the dark web and, together, we were able to rapidly bring to life the fruit of those previous discussions.
